New Research Finds Half of SOCs are Ineffective

How the Security Operations Center Can Create Customer Confidence

New survey data suggests that a new way of looking at SOC management is overdue.

The Respond Software and Ponemon Institute study says that the SOC is critical to working and performing in today’s digitized economy as a greater share of business operations and sensitive data is brought online, with 73 percent of respondents viewing their SOCs as crucial elements of their cybersecurity strategies.

The cost that organizations spend on their SOCs reflect this importance, as the research revealed that organizations spend on average $2.86 million annually on their in-house SOCs. Significantly, the cost balloons to $4.44 million annually if organizations outsource to a managed security service provider (MSSP), neutralizing any cost savings from outsourcing.

Despite that substantial investment, almost half (49 percent) of survey respondents are dissatisfied with the effectiveness of their SOC in detecting attacks. Of those who turned to a managed security service provider (MSSP), 58 percent rated their MSSP as ineffective.

Part of this dissatisfaction, it says, stems from the high cost of MSSPs; often twice the cost of staffing and managing a SOC in-house. A majority of the respondents (63 percent) are looking for a way out, including reviewing new vendors or bringing the SOC function in-house.

The research also uncovered challenges with running an in-house SOC as well. Those organizations that run their SOCs internally struggle with significant staff burnout and turnover. Seventy percent of respondents agreed that their SOC analysts burn out quickly because of the high-pressure environment and workload, with information overload and chasing too many alerts as the main stressors.

Larry Ponemon, chairman and founder, Ponemon Institute, said: “This study highlighted many of the challenges and perceptions regarding company SOCs, including the substantial impact and cost of personnel for in-house SOCs. Many organizations thus turn to outsourcing, but 58 percent find their MSSPs to be either ineffective or only moderately effective. This creates a conundrum that suggests a third-way solution is necessary.”

The full report is available for download here.

ON DEMAND: Business-impacting events such as severe weather, man-made disasters, and supply chain disruption are increasing in frequency and making impacts around the globe.

In today's rapidly evolving security landscape, organizations face an ever-growing array of disruptive events, security threats and risks. Traditional reactive approaches to security intelligence often leave businesses vulnerable and ill-prepared to anticipate and mitigate emerging threats that could impact the safety of their people, facilities or operations.